Unzip and open PHPGuard.xcodeproj in Xcode 16 or later.
Select the PHPGuard scheme and My Mac destination.
Set your signing team in Signing & Capabilities if required.
Build and Run (⌘R).
Add a server (SSH hostname, username, port and optional identity file).
Ensure you can first connect from Terminal using SSH and that its host key is in ~/.ssh/known_hosts.
Click Scan now. Scan history and JSON export are available.

The app uses /usr/bin/ssh with BatchMode=yes and strict host key checking. It does not store passwords or change remote systems. SSH keys must already be configured. For the initial release, the app runs unsandboxed so it can invoke the system SSH executable and access existing SSH configuration.

Implemented

Native macOS SwiftUI navigation and dashboard
Add/edit/remove SSH servers; optional private-key path
Concurrent read-only scans of PHP CLI binaries, PHP-FPM services, Nginx FastCGI routes, Debian/Ubuntu PHP package inventory
Local JSON persistence and history
JSON report export
SSH error reporting and strict host key checking

Not yet implemented

Live CVE feeds, Ubuntu package backport verification or definitive vulnerability status
Docker and Apache scans
Intrusion detection and web-log investigation
PDF reports, scheduled scans, notifications, automated patching
Integration with PegasusMonitor

Important: This version is an inventory tool, not a complete vulnerability or compromise scanner. It intentionally does not label a server secure solely from a version string.

Privacy

Server definitions and scan results are stored in ~/Library/Application Support/PHPGuard/. Scan reports may contain internal hostnames and package inventory. Do not publish them publicly.